Submission Summary:

• Submission details:
• Submission received: 11 August 2012, 23:40:36
• Processing time: 11 min 20 sec
• Submitted sample:
• File MD5: 0xE73378C347E30457FDBC021D70E6923E
• File SHA-1: 0xA90148DA5C942F2649ABBBC59E806F541BBD7484
• Filesize: 687,426 bytes
• Alias:
• Bloodhound.Malautoit [Symantec]
• Mal/Espion-B [Sophos]

• Summary of the findings:

What's been found	Severity Level
Produces outbound traffic.
Creates a startup registry entry.

Technical Details:

File System Modifications

• The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	%AppData%\systeme32\msn.exe %ProgramFiles%\systeme32\msn.exe	374,538 bytes	MD5: 0xBB671B12EB6DDA1ACF6BCE881CF11B63 SHA-1: 0xEFFD46760ACE59DB592AFB849AC42E515A7E6D13	Bloodhound.Malautoit [Symantec] packed with UPX [Kaspersky Lab]
2	%AppData%\systeme32\skype.exe %Windir%\msn.exe %Windir%\systeme32\skype.exe %Windir%\~olojdgw.exe	374,919 bytes	MD5: 0x18F53EF8FD70612330ED7D600E8784AA SHA-1: 0x34E612488C0866F618A599CC338D3C47447FDACE	Bloodhound.Malautoit [Symantec] packed with UPX [Kaspersky Lab]
3	%Windir%\skype.exe	375,300 bytes	MD5: 0xC63C9E5100E17FA6A2666341ED070278 SHA-1: 0x7379A43AFAE1AA6244889AFD552EDBD4B4DFF97E	Bloodhound.Malautoit [Symantec] packed with UPX [Kaspersky Lab]
4	[file and pathname of the sample #1]	687,426 bytes	MD5: 0xE73378C347E30457FDBC021D70E6923E SHA-1: 0xA90148DA5C942F2649ABBBC59E806F541BBD7484	Bloodhound.Malautoit [Symantec] Mal/Espion-B [Sophos] packed with UPX [Kaspersky Lab]

• Notes:
• %AppData% is a variable that refers to the file system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\[UserName]\Application Data.
• %ProgramFiles% is a variable that refers to the Program Files folder. A typical path is C:\Program Files.
• %Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.

• The following directories were created:
• %AppData%\systeme32
• %ProgramFiles%\systeme32
• %Windir%\systeme32

Memory Modifications

• There were new processes created in the system:

Process Name	Process Filename	Main Module Size
msn.exe	%Windir%\msn.exe	745,472 bytes
~olojdgw.exe	%Windir%\~olojdgw.exe	36,864 bytes
skype.exe	%Windir%\skype.exe	36,864 bytes
skype.exe	%Windir%\systeme32\skype.exe	36,864 bytes
~olojdgw.exe	%Temp%\~olojdgw.exe	36,864 bytes
[filename of the sample #1]	[file and pathname of the sample #1]	741,376 bytes
msn.exe	%ProgramFiles%\systeme32\msn.exe	36,864 bytes

• Notes:
• %Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).

Registry Modifications

• The following Registry Keys were created:
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{07A5AEC1-B5C7-032D-50A8-5238F55F0FB1}
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{130DA77E-95A0-D4D7-C896-FC5F4A3A0920}
• HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost9999
• HKEY_LOCAL_MACHINE\SOFTWARE\skype1111
• HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\msvideo
• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\MediaResources\msvideo
• HKEY_CURRENT_USER\Software\Bifrost9999
• HKEY_CURRENT_USER\Software\skype1111

• The newly created Registry Values are:
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{07A5AEC1-B5C7-032D-50A8-5238F55F0FB1}]
• stubpath = "%ProgramFiles%\systeme32\msn.exe s"

so that msn.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{130DA77E-95A0-D4D7-C896-FC5F4A3A0920}]
• stubpath = "%AppData%\systeme32\skype.exe s"

so that skype.exe runs every time Windows starts

• [HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost9999]
• nck = DA 1F ED 2F CC 44 A2 32 74 C3 CD 74 FA 93 5B 67
• [HKEY_LOCAL_MACHINE\SOFTWARE\skype1111]
• nck = E4 2C D8 1E 94 44 A2 32 74 C3 CD 74 FA 93 5B 67
• [HKEY_CURRENT_USER\Software\Bifrost9999]
• klg = 00
• [HKEY_CURRENT_USER\Software\skype1111]
• klg = 00

Other details

• Analysis of the file resources indicate the following possible country of origin:

	United Kingdom

• To mark the presence in the system, the following Mutex objects were created:
• skype12
• Bif1999

• The following Host Names were requested from a host database:
• athmane.no-ip.biz
• sami24.no-ip.biz

• There were registered attempts to establish connection with the remote hosts. The connection details are:

Outbound traffic (potentially malicious)

• There was an outbound traffic produced on port 81: